andrewlock / NetEscapades.AspNetCore.SecurityHeaders

Small package to allow adding security headers to ASP.NET Core websites
MIT License
701 stars 73 forks source link

Update Features to Latest Available #176

Closed Registeel closed 2 months ago

Registeel commented 2 months ago

These findings are based on warnings in browser consoles and this Permissions Policy spec.

There are multiple obsolete features included in the "PermissionsPolicyBuilder" list that should be labeled obsolete:

The following are now supported on most modern browsers and can be added:

andrewlock commented 2 months ago

Thanks for the update, it's kind of sad though that "most modern browsers" basically means "Chrome", given neither Firefox or Safari support them 😅

Registeel commented 2 months ago

@andrewlock Agreed. It's pretty ridiculous. This may not be terribly important given they can just be included with the AddCustomFeature call but figured I would add it anyways. If you're cool with the idea for these changes just adding functionality and marking those few old features obsolete I could work on these changes tonight. I don't mind. I've already forked master and looked at the implementation.

andrewlock commented 2 months ago

I've been a bit torn about how to manage it tbh - initially I didn't want to include experimental features really, as if they change it could be problematic (such as has happened for speaker and vr). But given we already include other experimental values, that doesn't seem very consistent 🤷‍♂️

So that's a long winded way of saying "sure, thanks!" 😄 At least for adding the new ones - we shouldn't mark the old ones obsolete IMO, as that's technically a breaking change. I'll do that in a major version bump PR instead.

Thanks again!

Registeel commented 2 months ago

Sounds good! We could always add an [Experimental] attribute to give to those features so developers can at least see their state without needing to go to the Mozilla docs?

No problem at all!

Registeel commented 2 months ago

@andrewlock I think the PR for this is ready. There may be one or two things I have missed updating in my files for new versioning for nuget deployment. Not sure if you needed me to update the version file or not. The PR is open to edit by maintainers if you notice anything you want to change. Can also add a comment and I can fix things you see that don't seem correct.

andrewlock commented 2 months ago

Just pushed out a new version with support in 0.24.0. Thanks again for your help @Registeel!